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DATE: July 17, 2009 

SUBJECT: Management Alert: Internal Control Weakness Identified in OTR's 

Processing of Receipts from the Collection Division's Post Office Box 

(IA:OTR:2907:C12(1) 

This is in response to your memorandum dated May 29, 2009, Report Number 
IA:OTR:2907:C13(1) in which you state that you identified an Internal Control 
Weakness in the Collection Division Processing of Receipts from its Post Office box. 

We reviewed your report and agree with the conclusions. 

In order to provide better separation of duties and insure the integrity of the receipt and 
accounting of payments we have revised the entire process as it relates to the PO Box for 
the Collection Division. The mail in the PO Box will no longer be picked up by the 
Collection Division. This responsibility has now been assigned to the Returns Processing 
Division. The new procedures will consolidate the receipt and processing of all mail in 
one place. The new procedures should also result in shorter deposit time for subsequent 
payments received by OTR from delinquent taxpayers. These procedures will be fully 
implemented by July 24, 2009. 

A copy of the new procedures is attached for your information. If you have any 
questions or require additional information regarding our response or progress towards 
implementation please call me or have a member of your staff contact Glen Groff, 
Director of Operations, at (202) 442-6499. 

cc: Glen Groff, Director of Operations, OTR 

Bedell Terry, Director of Compliance Administration, OTR 

Portia Perry, Chief of Collections, Compliance Administration, OTR 

Mohamad Yusuff, Internal Audit Director, OIO 

Nelson, Alii, Senior Manager, OIO 

Tisha Edwards, Audit Manager, OIO 
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A/R and Compliance Payment Processing 

Background: Generally, taxpayers are mailing in payments for Accounts 
Receivables (A/R) or bills using one of the following methods: 

1. Mailing in the payment with the bill (A/R) to the address on the bill which 
directs the mail to PO Box 419 

2. Send the payment with the bill (A/R) or note to the 941 N. Capitol St address 

3. Send the payment to PO Box 37759 which is the address provided for cases 
being handled by Collection. 

4. Taxpayers also send payments to PO Box 556 which is designated for use for 
Audit work. 



PO BOX 


RETURN/DOCUMENT IDENTIFICATION 


419 


Revenue Officer's work - RPA Pick Up 


556 


Audit Division - RPA Pick up 


37759 


Collection Pick Up 




941 North Capitol St Address (white mail) 



Payments received through PO Box 419, PO Box 556 and the 941 North Capitol St 
address is picked up daily by RPA and subjected to normal extraction and sorting. 
All mail addressed to a specific person or regarding a specific case is copied and 
forwarded to Compliance. Checks and the attachments are forwarded to Code and 
Edit Unit for additional processing. This processing involves the following: 

1. For all A/R documents with scan line data, Code and Edit compares the 
check information to the A/R document. If in agreement, the A/R document 
and check are batched and sent to the deposit activity, using the NCR 
scanner, for deposit of the check and processing of the A/R document. 
Following scanning and deposit, the transaction is sent to the Data Repair 
unit for keying of the bill number and any other data not recognized during 
the scanning process. Once the A/R has been processed thru Data Repair, 
the payment can be applied to the taxpayers account. 

2. For all A/R documents without a scan line present, Code and Edit will look to 
see if the check has period/tax information or the taxpayers account is 
reviewed to ensure we know the true tax period or tax type. After the tax 
type and tax period information is determined, the A/R document and check 
is batched and forwarded to normal processing using the NCR scanner 
system. Following scanning and deposit, the transaction is sent to the Data 
Repair unit for keying of the bill number and any other data not recognized 
during the scanning process. Once the A/R has been processed thru Data 
Repair, the payment can be applied to the taxpayers account. 
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3. If the incoming check indicates the payment is for multiple tax periods or 
that it can not be determined what the payment is to be applied against, a 
copy of the check and correspondence (if any) is copied and transmitted to 
Compliance for proper posting information. Once Compliance has identified 
the correct posting information, Code and Edit will apply the payment based 
on the information supplied. These payments are treated as a Key Punch 
documents defined below. 

Payments mailed to PO Box 37759 are picked up by Compliance which 
subsequently provides the checks along with Payment Posting Vouchers (PPV) to 
define the proper allocation or tax period/tax type information to be associated with 
the check. Payment posting vouchers are received in the RPA receiving room and 
then controlled to Code and Edit. PPV's are processed using a procedure called 
"Key Punch". Key Punch processing involves keying data from the PPV into a 
system that produces a hard copy document which is submitted from processing, 
with the check attached thru Document Prep unit, into the Scanning unit, via 
Banktec scanners, back to the deposit activity and then into data repair all prior to 
posting of the money to the taxpayers account. 
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Proposed Processing Procedures: 

1. Change Receipt and Control MOTR to provide instructions requiring RPA 
to pick up from all Post Office boxes including PO Box 37759. 

2. Payments received in PO Box 37759 will be merged with payments picked up 
from PO Box 419, PO Box 556, and the 941 North Capitol St address and 
subjected to normal extraction and sorting. All mail addressed to a specific 
person or regarding a specific case will be copied and forwarded to 
Compliance. 

3. The extraction and sorting unit with RPA will assign PO Box 37759 mail as 
one of its first priorities each day. 

4. Change the Code and Edit MOTR to indicate that checks and the 
attachments are forwarded to Code and Edit Unit who will use the following 
procedures: 

a. For all A/R documents with scan line data, Code and Edit compares 
the check information to the A/R document. If in agreement, the A/R 
document and check are batched and sent to the deposit activity, 
using the NCR scanner, for deposit of the check and processing of the 
A/R document. Following scanning and deposit, the transaction is 
sent to the Data Repair unit for keying of the bill number and any 
other data not recognized during the scanning process. Once the A/R 
has been processed thru Data Repair, the payment can be applied to 
the taxpayers account. 

b. For all A/R documents without a scan line present, Code and Edit will 
look to see if the check has period/tax information or the taxpayers 
account is reviewed to ensure we know the true tax period or tax type. 
After the tax type and tax period information is determined, the A/R 
document and check is batched and forwarded to normal processing 
using the NCR scanner system. Following scanning and deposit, the 
transaction is sent to the Data Repair unit for keying of the bill 
number and any other data not recognized during the scanning 
process. Once the A/R has been processed thru Data Repair, the 
payment can be applied to the taxpayers account. 

c. If the incoming check indicates the payment is for multiple tax 
periods or that it can not be determined what the payment is to be 
applied against, a copy of the check and correspondence (if any) is 
copied and transmitted to Compliance for proper posting 
information. An aging log will be noted to record the taxpayer's 
name and the date the copies were sent to Compliance. This log will 
be reviewed daily and any request older than three business days will 
be elevated to the Director or Deputy Director of Compliance. Once 
Compliance has identified the correct posting information, Code and 
Edit will apply the payment based on the information supplied. If the 
payment has been identified to one specific tax period or tax type and 
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if the profile exists within IDCS, the payment will be processed using 
a D40P, D20/30P etc. If there is not a profile for the tax year 
specified, the payment will be processed using Key Punch procedures. 

d. If the incoming check indicates or Code and Edit research determines 
that the check is to cover multiple tax periods within one tax type, the 
payment will be applied using a "P" document for the oldest tax 
period and allowing the system to offset any overage to more current 
tax periods. 

e. For all cases where the payment can be associated with a single tax 
account and where profiles exist, "P" documents will be used in lieu of 
key punch documents. 

To ensure timely processing of checks received from PO Box 37759, RPA will 
follow the 48 hour deposit cycle policy which specifies the length of time allowed for 
each unit to process checks (see attached diagram). The 48 hour deposit time frame 
represents payments that do not require Compliance research. 
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Management Alert: Internal Control Weaknesses Identified in OTR's Processing of Re- 
ceipts"from the Collections Division's Post Office Box <IA:OTR:2907:C 1 2( I ) 



The Office of Integrity and Oversight (OJO) is currently performing a review of the Office of Tax and 
Revenue (OTR) Compliance Administration Collections Division's (CD's) monthly collections data re- 
ported for the period October 1 , 2005 through October 3 1 , 2008, As part of this review, we conducted a 
""walk-through" of the collections receipts process w ithin CD. In our walkthrough, we identified several 
weaknesses in the sy stem of interna! controls for the processing of receipts by CD. This management 
alert provides our findings and four recommendations to improve the .sy stem of interna! control for these 
receipts. 

OIO determined that CD did not have functioning internal controls to safeguard the receipts from the CD 
Post Office Box {POB}. Further, controls were not in place to assure that the revenue officers (ROs) and 
tax examiners (TEs) processed POB receipts in compliance with the Office of the Chief Financial Offi- 
cer's (OCFO's) policy of two days from the dale of receipt of she funds. 

Background 

CD maintains a separate POB from that of the Returns Processing Administration (RPA) to collect tax 
receipts from individuals who have: (i) been referred to CD for delinquent payment of taxes, 1 and (ii) as- 
signed to a specific RO or TF for collection action. Further, the POB takes in receipts from those taxpay- 
ers whose delinquent accounts have been assigned to a debt collector, under contract with CD. Addition- 
ally, the POB provides a location for taxpayers to mail correspondence to CD or a specific RO or I F. 

The CD asserts that the POB allows them to better track the progress of their collection efforts, as a 
whole, and the collection efforts of a specific RO or TF. They further assert that the POB allows them to 
ensure that the funds received are identified as collections and credited to the proper taxpayer account, in 
cases where a taxpay er has multiple delinquent accounts, Furthermore. CD assert* by Inning the RO or 



' Hie term tax, for this memorandum, doe-, not include taxes on real property: which are processed ihroueh the Real 
Property lax Administration 
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I complete the payment posting voucher CPPV i this reduces the time necessary to process individual 
payments within RPA. as the research work is already done and the RO or 11: identified the proper ac- 
counts} for crediting. 

I he POB is the largest single receipt point for collections. W ith the exception of late returns CD asserts 
that the majority of the delinquent tax receipts come through the POB. 

Absence of Controls for POB Receipts 

OK) found the absence of a functional system of internal controls and procedures for the in-comtm; re- 
ceipts and tracking of tax payments received through the POB. Taxpayer pas merits were not separately 
identified and tracked until the RO or 1 1 delivered the payment to RPA for processing. We found that 
there was no system in place to ensure thai all payments receiv ed on a specific date were distributed to the 
collection teams, processed as a contractor collection, or referred to a team or specific individual for reso- 
lution of a payment issue or question, 

A sole clerical assistant (CA) is responsible for the pickup of the mail receipts, sorting and delivering 
those receipts to the respective collection teams, and processing the payments generated by the CD debt 
collection contractors. This function is rotated on a weekly basis among the CA"s assigned to the Collec- 
tions Div ision. 

The current system does not follow the receipts from collection at the post office through final processing 
in the integrated tax system (ITS). Envelopes containing potential receipts are not logged or opened to; 
(i) determine whether they contain taxpayers" receipts, and (ii) the amount of the receipts. CD does not 
restrtctively endorse cheeks as they are received. Instead the checks are not endorsed until they reach 
RPA for processing. The current process may require the check to pass through five different individuals 
before it is endorsed and tracked in RPA. This significantly increases the chances for the payment to be 
lost, manipulated, or diverted by a number of different individuals. The current system does not provide 
accountability for the receipts, and the only individuals that CD can reasonably assure were involved in 
the processing, are the CAs who sort and distribute the receipts from the POB. 

Internal controls over cash receipts are fundamental to management's accountability over cash and a basic 
requirement to "best practices" of management oversight. Without controls in this area, an organiza- 
tion's management has no assurance that it is receiving all of the payments directed to it. The U.S. Gov- 
ernment Accountability Office (GAO). in its publication Internal Control Standards in the Federal Gov- 
ernment {Standards), discusses the objectives of a system of internal controls. They state in part;. 1 

"A subset of these objectives is the safeguarding of assets. Internal control should be designed t» provide 
reasonable assurance regarding the prevention of or prompt detection of unauthorized acquisition, use. or 
disposition of agency's assets. " 



GAO also addresses the issue of controls for vulnerable assets in stating that: 



the term checks for the purposes of this memorandum include persona! and business checks, money orders, cash- 
ier and treasurer's checks, certified checks and other negotiable instruments. It does not include payments made in 
currency and coin. 

' U.S. Government Accountability Office, formerly the U.S. General Accounting Office; Internal ( Vmirol Standards 
lor the Federal Covemment: Report Number; GAO AIMD-00.2 1.3.1; November IW, pane 5, 

' Ibid; page 15. 
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" ^'"'v* resources and words should he limited to autlitnized individual*, and accountability for their 
custihh- and tiw should be ass i fined and maintained. Periodic comptirisnn ofreswirce* mt/i the recorded 
accountability should he made io help reduce the risk of errors, fraud, misuse. or unauthorized alteration " 

Based on the system in place in May 2(KR CD cannot provide, a reasonable assurance shut all POB re- 
ceipts are properly safeguarded, that the R( )s and 1 1 s process the receipts prov tded to them in accordance 
with OCR.) policy, and that all other receipts received through the PUB are processed timelv. We found 
a more than remote possibility that payments could be lust, or manipulated with only a ver\ limited pos- 
sibility of detection by another CD employee. 

The following describes the weaknesses we noted during our ""walk-through"" of the POB receipts process: 
/. A hsence of Documentation to Support the Controls of Taxpayer Receipts 

OiO found that CD does not effectively document its POB receipts until the RO or IT sends the indiv id- 
ual receipt and payment to RPA for processing. As noted before, this may take several davs and the pav- 
ment may pass through as many as five individuals without documentation. Only the CA who is respon- 
sible for the sorting and delivering of mail can be definitively determined, through the CD assignment 
sheet. The current CD process relies on the veracity of the indiv iduals who receive the payments and the 
subsequent timely processing of those payments. The current practices provide more than a remote op- 
portunity for payments to be tost, delayed in processing, or intentionally diverted. 

The CA is not required to enter the payment data into a paper or electronic log or to identify specific 
payments that are sent to ROs and TEs within the various teams. This entire process is generally done 
solely by the individual CA with limited oversight. Sole responsibility for assuring that all POB receipts 
received that day are processed by the close of their tour of duty . 

Once the mail has been delivered to the CA who supports the specific collection teams, the CA distributes 
the mail to the respective individual RO or IE for processing and preparation of a PPV for the payment 
they received. The RO or IE may make copies of the pay ments received and the resulting PPV for their 
records: however, this is not required by CD. The RO or TE may return the check and PPV to the CA or 
deliver it directly to RPA for processing. The only records maintained to this point are those voluntary 
records held by the individual RO or TE for the delinquent accounts they have been assigned. Further, 
until the receipt is entered into ITS by RPA. there is no formal record of the payment. 

A basic tenet of a functional sy stem of internal control for taxpayer cheeks is that control and tracking of 
the checks be established as soon as feasible and that controls for the handling and processing of the re- 
ceipts be documented throughout the process. These controls provide an accountability trail of the indi- 
viduals) responsible for processing the receipt and prov ide a reasonable assurance of the t ime it takes to 
process an individual receipt. Accountability for pay ments is a critical component of any internal control 
system for cash receipts. Further, restricting access to the payments and the processing for chose pay- 
ments minimizes the chances for inadvertent or intentional loss of the payment or errors identifying the 
payment and the correct account to which it should be charged. 
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2. Inadequate Separation of Duties 

OIO runes that the duties for processing the payments received Ironi the FOB rests solely with the CA 
who picks up the mail. Current!}, a ( A from CI) is assigned on a weekly basts to: 

• pick-up the mail from the POB; 

• sort the mail for processing by the collection teams; 

• deliver the soiled mail to the CA who supports the spec i lie collection team: 

• open the mail whose destination cannot be determined i'rom the envelope and sort the mail to the ap- 
propriate collection team; 

• open the mail from collection accounts, prepare PPVs for the pin men ts received from taxpayers, and 
deliver the payments to RPA for processing: and 

• resolve, with a supervisor, any questions regarding to whom a payment or correspondence should be 
referred. 

If appears that no other individual verifies that all the payments received during a specific day have been 
appropriately distributed or that the PPVs are prepared. When a large number of pay merits are received, 
it appears that the CA is responsible for notifying a supervisor and requesting assistance to process the 
payments. The current process places almost exclusive reliance on the CA and does not account for er- 
rors in the processing of the mail which may significantly delay the processing of a taxpay er's payment. 
Further, die process does not provide reasonable assurance that all the payments received have been proc- 
essed. 

Separation of duties is a critical component of any system of internal control. GAO in its Stamfords pub- 
lication states : 

"Key duties and responsibilities need to he divided or segregated among different people let reduce the risk, 
of error or fraud This should include separating the responsibilities for authorizing transactions, process- 
ing and recording them, reviewing the transactions, and handling any related assets. No one individual 
should control all key aspects of a transaction or event. " 

By separating duties CD management can provide reasonable assurance that all payments received 
through the POB are initially recorded and distributed to the collection teams for further processing. The 
separation allows for the responsibility for sorting and processing payments over a number of individuals, 
effectively spreading the workload among several individuals and not placing it solely in the hands of a 
single individual. 

3. Restrictive Endorsement of Taxpayer's Payments 

CD's POB receipt processing does not require the restrictive endorsement of a taxpayer's payment upon 
receipt. OIO found that payments were not endorsed until the check was processed by RPA in some 
cases this could be several day s later. As we previously slated, a pay ment received through the POB may 
pass through up to five individuals without being restrictively endorsed. This process increases the poten- 
tial for the check lo be negotiated by an individual, who is not authorized to do so. and increases the pos- 
sibility that should a check be lost or misplaced it could be negotiated by an unauthorized individual. 
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One of the fundamental principles of a sound sxstem of internal controls is to protect vulnerable asset* 
from unauthorized use or manipulation, or being unaccounted for. Placing restrictive endorsements on 
individual checks limits the ability of an individual to improper!) negotiate a pawnent. 

R ^commendations 

We recommend that the Director of the Compliance Administration implement the following recommen- 
dations to establish a reliable system of interna! controls o\ er OTR's POB receipts: 

1. Develop a system that tracks the taxpayer's payments from the initial receipt from the FOB through 
turning over the checks and related PPV to the RPA for processing. This system should provide for a 
separation of duties so that no single individual can control the entire transaction stream. 

2. Develop a database or spreadsheet application to log receipts from the POB. I his application should 
contain fields to capture the (i) taxpayer's name, (ii) taxpayer identification number or account num- 
ber, (iii) the specific account that the payment is to be credited to, (iv) amount of the payment; (v) 
date the payment was received: and (vi) the RO. IE, or team to whom the pa\ merit was given. 

3. Require that the CA sorting the mail from the POB to enter the payments into the database spread- 
sheet as the mail is being sorted. 

4. Require that all checks be restrtctively endorsed at the point of initial receipt by the CA processing 
the POB receipts. 

Please provide a response to this Management Alert within fifteen (15) business days of receipt of this 
memorandum report. If you have any questions, please contact Mohamad Vusuff. Internal Audit Director 
at 442-8240, orTisha Edwards, Audit Manager, at 478-9143. 

cc: Glen Groff, Director of Operations. OTR 

Bedell Terry, Director of Compliance, OTR 
Portia Perry, Chief of Collections, OTR 
Mohamad YusufT, Internal Audit Director, OlO 
Nelson Alii, Senior Manager. OIO 
Tisha Edwards, Audit Manager. OIO 
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